Description
The worst C and C++ bugs are the ones the compiler waves through and that only crash occasionally at runtime: one byte written past the end, a pointer used after it was freed, a variable left uninitialised on exactly one branch. Cppcheck finds those by analysing the source without compiling it, and it treats a low false-positive rate as a design goal — most of what it reports is worth reading, instead of thousands of lines of noise that make everyone turn the tool off.
It does not need a working build. Missing headers and unresolved dependencies are fine, so you can point it at unfamiliar code and get a first pass immediately. There are two ways to run it: the command line binary drops into CI and blocks a merge on a non-zero exit, while the desktop GUI groups findings by file and severity, jumps to the offending line on a click, and explains the CWE number and the reasoning underneath.
Undefined behaviour first: out-of-bounds access, null dereferences, use-after-free, uninitialised variables and integer overflow — the bugs that actually crash programs — are what it goes after.
No build required: the project does not have to compile and the include paths do not have to be complete; having the source is enough to start.
Graded severities: error, warning, style, performance, portability and information are listed separately, so a team can start by reading only the first two and decide for itself which grade blocks a merge.
Coding-standard addons: MISRA, CERT and AUTOSAR rule sets ship as addons, which matters for automotive and medical projects that have to demonstrate compliance.
Both a CLI and a GUI: the CLI produces machine-readable reports for a pipeline; the GUI puts the file tree, severities, warning detail and highlighted source in one window for a human.
Fits an existing toolchain: plugins exist for most mainstream IDEs and editors, and it can read a Visual Studio project or a compile_commands.json directly to work out the translation units.
Free and open source: GPL licensed, with builds for Windows, macOS and Linux.
It does not need a working build. Missing headers and unresolved dependencies are fine, so you can point it at unfamiliar code and get a first pass immediately. There are two ways to run it: the command line binary drops into CI and blocks a merge on a non-zero exit, while the desktop GUI groups findings by file and severity, jumps to the offending line on a click, and explains the CWE number and the reasoning underneath.
Features
Undefined behaviour first: out-of-bounds access, null dereferences, use-after-free, uninitialised variables and integer overflow — the bugs that actually crash programs — are what it goes after.
No build required: the project does not have to compile and the include paths do not have to be complete; having the source is enough to start.
Graded severities: error, warning, style, performance, portability and information are listed separately, so a team can start by reading only the first two and decide for itself which grade blocks a merge.
Coding-standard addons: MISRA, CERT and AUTOSAR rule sets ship as addons, which matters for automotive and medical projects that have to demonstrate compliance.
Both a CLI and a GUI: the CLI produces machine-readable reports for a pipeline; the GUI puts the file tree, severities, warning detail and highlighted source in one window for a human.
Fits an existing toolchain: plugins exist for most mainstream IDEs and editors, and it can read a Visual Studio project or a compile_commands.json directly to work out the translation units.
Free and open source: GPL licensed, with builds for Windows, macOS and Linux.
